512b44ab251bb7929da9762325d51a44a0624aec431ddb75e33b2eac54d44e6d

Analysis

max time kernel
3s
max time network
0s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
19/04/2024, 02:20

Target

f94a3fad8712de4195609bb9fcbdd863_JaffaCakes118.dll
Size

84KB
MD5

f94a3fad8712de4195609bb9fcbdd863
SHA1

c88a78fe6d7e10cb26a6dc6c8bbddb12e666676c
SHA256

512b44ab251bb7929da9762325d51a44a0624aec431ddb75e33b2eac54d44e6d
SHA512

8303f0bebc57c10f497300d4ce3cef6fecebdf4e8de87e2b008351e43edc1b85867303613d290e18f678f5e10cb85bd37e2972d5df43203b4ccd19b87b2dafec
SSDEEP

1536:HRiDcbmAYk7MWP3YzYPXjGuoJYVMxmRWAC7im6VJuia:8DkHYk56YrGuoJYVMjX7im6Voia

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1244 wrote to memory of 1624	1244	rundll32.exe	28
PID 1244 wrote to memory of 1624	1244	rundll32.exe	28
PID 1244 wrote to memory of 1624	1244	rundll32.exe	28
PID 1244 wrote to memory of 1624	1244	rundll32.exe	28
PID 1244 wrote to memory of 1624	1244	rundll32.exe	28
PID 1244 wrote to memory of 1624	1244	rundll32.exe	28
PID 1244 wrote to memory of 1624	1244	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f94a3fad8712de4195609bb9fcbdd863_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1244
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\f94a3fad8712de4195609bb9fcbdd863_JaffaCakes118.dll,#1
  2⤵
  PID:1624

memory/1624-0-0x0000000000180000-0x000000000018B000-memory.dmp

Filesize
44KB

Download
memory/1624-1-0x0000000010000000-0x000000001000A000-memory.dmp

Filesize
40KB

Download